Website terms

These terms are an agreement between you and Tenhaw LTD about one thing: your use of this website. Using the site means you accept them. If you do not accept them, the remedy is not to use it.

They are not settled cloud-service terms or the customer-hosted software licence. The source-available licence describes use, modification, self-hosting and bounded security-research rights for software on infrastructure you control. It does not authorize testing this website or a shared cloud service, and it remains a template pending review.

They are not an Order Form. No paid cloud price, plan, subscription scope or automatic paid conversion is published by this page. Customer commercial terms remain to be agreed.

They are not a support agreement. Existing software support documents describe proposed severities and support scope; they are not an agreed cloud response or availability commitment.

Where any of those three says something different from this page, it governs and this page yields. That ordering is deliberate, and it is the answer to most of the questions this page would otherwise be asked.

Tenhaw LTD, a company registered in England and Wales under company number 12735685, incorporated on 10 July 2020, based in London, England. Its registered office is Tenhaw / Qube, 29-33 Scrutton Street, London, England, EC2A 4HU. The Companies House record is public and linked below. Telephone +44 7548 516643.

Tenhaw LTD publishes Token Observe. Token Observe is the product name and Tenhaw LTD is the legal entity, and the site does not blur them: it is Tenhaw LTD you would be contracting with, on an Order Form, under the licence.

General correspondence, including anything about these terms, goes to hello@tenhaw.com. Security correspondence, including a vulnerability found in this website, goes to security@tenhaw.com. No VAT registration number is asserted on this page; whether one belongs here is on the list at clause 17.

Read it, print it, and put it in a file. Several pages, the security page in particular, are written to be printed into a vendor assessment and the print styles exist for that purpose. Quote from it in an internal document, a questionnaire response or a piece of analysis, provided the quotation is accurate and attributed to Token Observe or Tenhaw LTD.

The content, design, text, diagrams and code of this website are owned by Tenhaw LTD or licensed to it, and are protected by copyright and database right. Nothing here transfers ownership of any of it. Republishing the site, or a substantial part of it, as your own is not covered by the paragraph above.

Tenhaw and Token Observe are our marks. Other names on this site — model providers, standards bodies, competing products — belong to their owners and appear because naming a thing accurately is the only honest way to compare against it. Their appearance implies no endorsement in either direction.

Reading marketing material, following the cloud journey or submitting the assisted form does not create a paid subscription or order. The assisted form is a request for help. Cloud account creation, workspace access and any separately agreed commercial arrangement are distinct actions.

No approved paid price or cloud commercial agreement is represented by these draft website terms. Any contractual formation, licence grant, fees, support scope and data-processing arrangements require their applicable reviewed documents.

The implemented cloud pilot provides a free 30-day evaluation from workspace creation. It collects no card and makes no automatic paid conversion. On expiry, new model traffic, workspace mutations and automatic billing collection stop; authorized retained reads and exports remain subject to the shared monthly traffic quota. Model requests, model-assisted searches and Google billing queries can incur charges on your own provider account. Those are technical product behaviors, not counsel-approved cloud evaluation terms. An optional customer-hosted evaluation is governed separately by the source-available licence supplied with it.

This site describes what the software does in unusual detail: an eleven-step governed request path, action-level permissions that deny by default, inline redaction in both directions, hash-chained evidence, six model providers under one identical policy set. Those descriptions are written to be accurate about a version of a piece of software. They are not warranties, they are not service levels, they are not representations about what your deployment will do in your environment, and they do not become terms of any agreement by having been published.

Software changes between versions, and a description of behaviour describes the behaviour at the time it was written. The binding statement of what you are entitled to is the signed Order Form and the licence. Where a capability matters enough to depend on, name it there rather than citing this site for it.

Two figures carry their conditions with them, and the conditions are part of the figure rather than a footnote to it. The published performance baseline is a laboratory measurement — thirty seconds at concurrency sixteen against a mock upstream on one laptop — and is evidence about a code path rather than a throughput commitment. Connecting an agent requires registration, assigned permissions and an issued credential, followed by a base-URL and credential change in a supported client. Compatibility depends on the dialect, software development kit and version. Quoting either without its condition misstates it.

The site also publishes what the product does not do, what is deliberately not claimed, and the residual risks with the named role that has to accept each one. Those pages are part of the description rather than a counterweight to it: a limit published beside a claim is as much a statement about the software as the claim is, and both are descriptions rather than commitments.

The site is provided as it is. Real effort goes into its accuracy — in this organisation a documentation claim that overstates a security property and cannot be substantiated in the code is treated as a security defect rather than as a typo — and even so we do not warrant that everything published here is accurate, complete or current, and we do not undertake to keep it up to date.

Nothing on this site is legal, regulatory, compliance, security or professional advice, and reading it creates no advisory relationship. The compliance pages map the product against the EU AI Act, ISO 42001, the NIST AI Risk Management Framework and OWASP guidance, with a coverage level stated on every row. A mapping describes what a control does; it is not an opinion that you are compliant, and it does not discharge an obligation you owe to a regulator, a customer or a data subject. Token Observe is a compensating control that produces evidence. Take your own advice.

Answers produced by the on-page assistant are generated by a language model from the text of this site. They can be wrong, they are not statements by the company, and where an answer matters it should be checked against the page, the licence or the source it was drawn from.

This site links to the product repository, to standards bodies, to regulators and to other vendors. We control none of them and are not responsible for their content, their accuracy or their availability. A link is a reference rather than an endorsement.

Source code in the repository is governed by the licence file in that repository and by nothing on this page. Where the two could be read as disagreeing about what you may do with the source, the licence governs.

Do not attempt to gain unauthorised access to this site or to anything behind it, do not interfere with its availability, and do not use it in a way that breaks the law or infringes anyone’s rights. Do not hold yourself out as us. Do not submit confidential information, or anyone else’s personal data, to the on-page assistant or to the assisted form; the form asks for your own work details and nobody else’s.

The site’s endpoints are public and unauthenticated, and automated use that degrades the service for other readers is not acceptable use. Ordinary crawling is, and the site publishes a machine-readable corpus precisely so that automated readers do not have to scrape it.

One distinction matters here more than it usually would. The licence’s permission to inspect, test, fuzz and penetration-test applies to Token Observe as deployed on infrastructure you control, and it is a genuine permission rather than a grudging one: section 9.1 extends it to any person operating an evaluation, not only to a signed customer. What you may publish afterwards is narrower than what you may test, and is stated narrowly at clause 15 rather than as a slogan. Neither right is permission to test this website. If you find a vulnerability in the site, it is welcome and the address is security@tenhaw.com; the same safe-harbour intent applies, and it is stated here rather than assumed.

We commit to no level of availability for this website, and we may change, suspend or withdraw any part of it without notice. A page that existed when you cited it may not exist later, so anything you need to rely on should be saved rather than linked.

No cloud availability service level, throughput commitment or service credits are published. The cloud service is a pilot, with live customer/provider and recovery qualification still open.

Nothing in these terms excludes or limits our liability for death or personal injury caused by negligence, for fraud or fraudulent misrepresentation, or for any other liability that cannot lawfully be excluded or limited. Nothing in them affects the statutory rights of a consumer.

Subject to that, and to the fullest extent the law permits: this website and everything on it is provided without warranty of any kind, express or implied; we exclude liability for any loss or damage arising from reliance on anything published here; and we exclude liability for indirect or consequential loss, loss of profit, loss of business, loss of anticipated savings, loss of goodwill, and loss or corruption of data, however arising.

This marketing website collects no card or payment. The hosted evaluation also collects no card and makes no automatic paid conversion, but configured provider usage can incur charges. These draft website exclusions do not settle liability under cloud terms, the customer-hosted software licence or a signed agreement. The appropriate website liability provisions remain for counsel to review.

The AI spend estimator runs in your browser tab and does not transmit or persist its inputs. Choosing export downloads a CSV to your device. Its calculations use your assumptions and are not provider billing, financial advice or an automatic reconciliation.

The privacy draft describes the website’s consent-gated analytics, local analytics-choice record, correspondence, on-page assistant and assisted form. The form collects work email and optional name, company, role and company size as one private Vercel Blob record; the configured Resend notice contains arrival details and company-size band rather than the submitted contact details. The current /start journey hands you to the cloud portal and no longer collects marketing-site email codes or offers a ZIP. Historical evaluation Auth and entitlement records may remain until a deletion policy is settled.

The homepage discovery calendar is provided by Cal.com. It loads as you approach its section, independently of your analytics choice. Booking details go to Cal.com and James Rooney as described in the privacy draft; scheduling does not create a cloud workspace or subscribe you to marketing. Declining analytics does not prevent discovery scheduling, the assisted form or following the cloud journey.

The privacy draft separately describes cloud account processing through Supabase Auth, Railway-hosted workspace evidence and encrypted connection credentials. The no-vendor-telemetry statement applies only to optional customer-hosted runtime operation. Cloud and booking processing roles, retention, transfer safeguards and data-processing terms remain open review items.

We may change these terms. The version that applies to your use of the site is the one published at the time you use it, so the date at the top of this page is the version marker. That date is generated from the change history of the file rather than typed by hand, and it moves when the words move.

The first substantial change to these terms will be whatever counsel returns.

If any provision of these terms is held to be unenforceable, the remainder continues in force and the provision concerned is treated as modified to the minimum extent necessary, or removed if it cannot be. A failure or delay in enforcing a term is not a waiver of it.

These terms are the entire agreement between you and Tenhaw LTD about your use of this website. They do not vary, override or add to the licence, an Order Form or a support agreement, and nothing in them confers a benefit on any third party under the Contracts (Rights of Third Parties) Act 1999.

You may not transfer your rights under these terms. We may transfer ours in connection with a reorganisation or a sale of the business, provided that your rights under them are not reduced.

These terms, and any dispute or claim arising out of or in connection with them or their subject matter or formation, whether contractual or non-contractual, are governed by and construed in accordance with the law of England and Wales.

The courts of England and Wales have exclusive jurisdiction to settle any such dispute or claim. If you use this website as a consumer resident elsewhere in the United Kingdom or in the European Union, you keep the protection of the mandatory provisions of the law of your own country of residence and may bring proceedings in its courts where the law gives you that right.

Cloud self-service is the default product path. Create an account, confirm email and provision a workspace without installing a Token Observe server. Connecting billing does not recover historical conversations; activity and inline governance require routed supported clients. The optional customer-hosted package and its source are private and remain subject to the source-available licence. This website does not grant shared-cloud penetration-testing rights or invent cloud commercial terms.

The licence permits use, modification and self-hosting under licence; reading the entire governance domain before buying, which is possible because the core package is pure functions with zero runtime dependencies; and security research. It forbids redistribution, and it forbids offering Token Observe as a competing hosted service.

The publication right that follows the security research is narrower than the right to do the research, and the difference is worth reading rather than summarising. Section 9.1 lets the Licensee, and any person operating an evaluation, inspect, test, fuzz, penetration-test and reverse-engineer the software as deployed on infrastructure they control, and commission a third party to do it for them. Sections 9.2 and 9.3 are drafted as the Licensee’s: benchmark results may be published with no pre-approval, provided the publication names the version tested and the configuration used, and security assessment findings may be published, naming the software, after coordinated disclosure. So an evaluator who intends to publish before an Order Form exists holds the right to attack the software but, on the drafting, should get the right to publish agreed in writing rather than read it across. The licence records that the maintainers already publish their own outstanding defects and says section 9 is meant to be consistent with that practice rather than to suppress yours. One caveat travels with every clause quoted in this one: the published licence is a template pending review by counsel rather than legal advice, and the final terms are the ones in your signed agreement.

The commercial shape around it is published in the same register: what a subscription counts and what it never counts, what the thirty-day evaluation grants and what it excludes, the support severities and response targets, and the three published reasons there is no availability service level. Prices are not published, and the reason is stated on the page rather than held back for a conversation.

Questions about these terms, about the licence, or about an Order Form: hello@tenhaw.com. Security correspondence, including a vulnerability in this website or in the software: security@tenhaw.com. Telephone +44 7548 516643. Both addresses reach a person rather than a queue, and both are the addresses published in the product’s own repository.

Tenhaw LTD, London, England. Registered in England and Wales, company number 12735685, incorporated 10 July 2020. Registered office: Tenhaw / Qube, 29-33 Scrutton Street, London, England, EC2A 4HU.

Collected here so that a solicitor has the open items as a list rather than having to find them.

What monetary cap, if any, belongs on clause 10 for a free informational website. Whether a VAT registration number belongs on clause 2, and what it is. Whether the consumer carve-out at clause 14 is drawn correctly for the jurisdictions this site is actually read in. Whether the acceptable-use boundary at clause 8 is expressed strongly enough to be useful and narrowly enough to leave the licence’s research permissions untouched. And whether the licence, the evaluation terms and the support language survive review in the words this site quotes them in — that review is the first item on the product’s own mandatory commercial gate, and it has not passed.

Until those are closed, this page is a draft published in the open rather than a settled instrument, which is the position stated at the top of it.